Re:How the Boeing 737 Max disaster looks to a software Devel...
by kortilla on Thursday April 18, 2019 @07:56PM
(#19695849)
No, you’re missing the point a bit. It’s not about the magnitude of the response, it’s about the propensity for a feedback loop.
=+1 is shorthand for “ignore everything going on in the world and increase your value”. This is almost never what anyone actually wants so they try to spend a bunch of time guarding against calling that when it’s already at a maximum.
Instead, the safe thing to do is only assign to it from a function with a ceiling.
val = min(CEIL, val+1)
It’s way to easy to get runaways with =+1 even in serious systems like this one. Every time I see that in code I review where the value is some long-lived thing, I just confirm with the author that they don’t care if it overflows, because it’s probably gonna happen.
=+1 is shorthand for “ignore everything going on in the world and increase your value”. This is almost never what anyone actually wants so they try to spend a bunch of time guarding against calling that when it’s already at a maximum.
Instead, the safe thing to do is only assign to it from a function with a ceiling.
val = min(CEIL, val+1)
It’s way to easy to get runaways with =+1 even in serious systems like this one. Every time I see that in code I review where the value is some long-lived thing, I just confirm with the author that they don’t care if it overflows, because it’s probably gonna happen.